The short version
- The matrix is a ranking tool, not a measurement. Its job is to sort risks into the ones that need a decision now, the ones that need a plan and the ones that are accepted. Treat the score as a triage category, not as a quantity.
- Calibration is the whole game. “Possible” and “Major” mean whatever the scorer wants until they are tied to a frequency band and a threshold. The template below defines every level that way.
- Score twice: inherent (before controls) and residual (after the controls that actually operate). The gap between the two is the value of the control, and it is what an auditor tests.
- Rating bands and escalation thresholds come from the risk criteria (ISO 31000 Clause 6.3.4), set before any risk is scored. Appetite can differ by category: an organisation may accept more financial risk than safety risk.
- Known weaknesses are real: ties, range compression and the illusion of precision. Use the matrix to triage, then quantify the handful of risks where the decision depends on the size of the number.
The 5×5 risk matrix
Likelihood runs down the side from 5 (Almost certain) to 1 (Rare); consequence runs across from 1 (Insignificant) to 5 (Severe). Each cell is likelihood × consequence, shaded by the rating band the fictional organisation has chosen. The scales behind the axes are defined in the next two sections.
| Likelihood ↓ · Consequence → | 1Insignificant | 2Minor | 3Moderate | 4Major | 5Severe |
|---|---|---|---|---|---|
| 5Almost certainMore than once a year | 5Moderate | 10High | 15High | 20Extreme | 25Extreme |
| 4LikelyAbout once a year | 4Low | 8Moderate | 12High | 16High | 20Extreme |
| 3PossibleAbout once in 3 years | 3Low | 6Moderate | 9Moderate | 12High | 15High |
| 2UnlikelyAbout once in 10 years | 2Low | 4Low | 6Moderate | 8Moderate | 10High |
| 1RareLess than once in 25 years | 1Low | 2Low | 3Low | 4Low | 5Moderate |
Illustrative bands for a fictional organisation. Colours and thresholds are set in the risk criteria and can differ by risk category.
Likelihood scale, defined as frequency
Each level is a frequency band over a one-year horizon with the evidence that supports it. The adjective is a label for the band, never the definition.
| Level | Label | Definition | Indicator |
|---|---|---|---|
| 5 | Almost certain | Expected to occur more than once per year; has occurred multiple times in the last 3 years | More than once a year |
| 4 | Likely | Expected to occur about once per year; has occurred in the last 3 years | About once a year |
| 3 | Possible | Could occur about once in 3 years; has occurred in the sector in the last 3 years | About once in 3 years |
| 2 | Unlikely | Could occur about once in 10 years; known to have occurred in the sector | About once in 10 years |
| 1 | Rare | Would occur less than once in 25 years; no known occurrence in the sector | Less than once in 25 years |
Consequence scale, defined as thresholds
Five consequence types share the same five levels so that any risk can be scored on the type that would hurt most. The financial thresholds are set as a percentage of revenue so the matrix scales with the organisation; the worked indicators assume a $50 million revenue entity.
| Type | 5 Severe | 4 Major | 3 Moderate | 2 Minor | 1 Insignificant |
|---|---|---|---|---|---|
| Financial | Loss greater than 10% of annual revenue, or breach of a banking covenant | Loss of 3–10% of annual revenue; material to the full-year result | Loss of 1–3% of annual revenue; absorbed but reported to the board | Loss under 1% of annual revenue; managed within divisional budget | Loss absorbed within normal operating variance |
| People and safety | Fatality or permanent disabling injury | Serious injury requiring hospital admission; lost time over 2 weeks | Injury requiring medical treatment; lost time under 2 weeks | First-aid injury; no lost time | Near miss; no injury |
| Regulatory and legal | Licence revoked or suspended; prosecution of officers; enforceable undertaking | Significant fine or formal enforcement action; mandatory external review | Reportable breach with a remediation plan accepted by the regulator | Technical non-compliance corrected internally; no external report | Administrative deviation; no compliance impact |
| Reputation | Sustained national coverage; loss of a major customer segment; ministerial attention | National coverage over several days; measurable customer churn | Trade or local media coverage; complaints from multiple customers | Isolated customer complaints; no media interest | No external awareness |
| Service delivery | Critical service unavailable beyond the maximum tolerable period | Critical service degraded for an extended period; SLA credits triggered | Non-critical service disrupted; workarounds in place | Minor degradation; users largely unaffected | No noticeable service impact |
Rating bands and what each one triggers
Bands turn a score into a decision. They come from the risk criteria, and appetite can differ by category; the bands below are the fictional organisation’s defaults.
Low 1–4
Accept and monitor. Managed through routine procedures; reviewed annually or on change.
Moderate 5–9
Manage through a named owner and a treatment plan with a date; reported to the responsible executive.
High 10–16
Treatment required and tracked at executive level; residual position reported to the board or audit and risk committee.
Extreme 17–25
Immediate executive attention; activity may be suspended until the risk is reduced; board informed.
The category-by-category escalation thresholds, appetite statements and key risk indicators that sit behind these bands are published in the risk criteria and appetite statement (PDF) or CSV.
Where the matrix sits in the ISO 31000 process
| ISO 31000:2018 step | What happens | The matrix’s role |
|---|---|---|
| 6.3.4 Defining risk criteria | Before anything is scored, the organisation sets its likelihood and consequence scales, the rating bands, and what each band means for escalation and acceptance. | This is where the matrix is designed. Doing it after the first workshop is the most common sequencing error. |
| 6.4.2 Risk identification | Risks are described as event, cause and effect, with an owner and a category. | The matrix plays no part yet. A risk that cannot be described clearly cannot be scored consistently. |
| 6.4.3 Risk analysis | Likelihood and consequence are assessed against the calibrated scales, first inherently and then with current controls and their effectiveness considered. | This is where the matrix is used. Record the evidence for each score, not just the number. |
| 6.4.4 Risk evaluation | The residual rating is compared with the risk criteria to decide whether the risk is acceptable, needs treatment or must be escalated. | The rating band and the appetite statement decide the outcome; the matrix only supplies the position. |
| 6.5 Risk treatment | Options are selected, treatment plans written and owners assigned; the expected residual rating after treatment is recorded. | Re-score only when the treatment is evidenced as operating, not when it is planned. |
| 6.6 and 6.7 Monitoring, review, recording and reporting | Ratings are reviewed on a cycle and on change; the register and the matrix feed board and committee reporting. | Heat maps built from the matrix are reporting outputs. They should always be traceable back to the register rows behind each dot. |
The full process, the principles and the framework clauses are explained in the ISO 31000 certification guide for Australia.
Seven rules for calibrating a matrix
- 01
Define likelihood as frequency, not as an adjective
Each level states how often the event is expected to occur over a stated horizon and what evidence supports it: incident history, sector data, control performance. “Possible” on its own is not a definition.
- 02
Define consequence as a threshold per type
Financial as a percentage of revenue so it scales with the organisation; safety as injury severity; regulatory as the enforcement outcome; reputation as the reach of coverage; service as time against tolerable outage. Score the worst credible consequence type, not all of them.
- 03
Set a time horizon
Likelihood is meaningless without one. State the period, usually one year for operational risk and the strategy horizon for strategic risk, and keep it constant across the register.
- 04
Make bands non-overlapping and exhaustive
Every level should have a clear boundary with the levels either side. If assessors keep arguing between two levels, the boundary is unclear; fix the definition rather than the people.
- 05
Score inherent and residual separately, with control effectiveness in between
Inherent is the exposure if the controls failed; residual is the exposure given the controls that provably operate. Rate control effectiveness (effective, partially effective, ineffective) with evidence, and let it drive the gap.
- 06
Record the basis of every score
A score without a reason cannot be challenged, reviewed or audited. One sentence of evidence per rating turns a subjective workshop output into a defensible record.
- 07
Tie bands to decisions, not just colours
Each rating band should name who decides, how fast and what happens: accept, treat, escalate, suspend. If two bands lead to the same action, the matrix has more bands than it needs.
What a matrix cannot tell you
The criticisms of risk matrices in the risk literature are well founded. They do not make the tool useless; they define what it is for.
Ties and range compression
A 5×5 grid has 25 cells but only 14 distinct scores, so unlike risks share a number: a 1 × 5 (rare but severe) and a 5 × 1 (constant but trivial) both score 5. Rating bands should treat those differently, which is why the template shades the top-right corner more severely than the diagonal alone would.
The illusion of precision
Multiplying two ordinal scores produces a number that looks quantitative but is not. A 12 is not “twice as risky” as a 6. Use the score to rank and sort; use real quantification (loss distributions, scenario costing) where a decision depends on the size of the exposure.
Centring
Workshop participants gravitate to the middle of both scales. Calibrated definitions with evidence requirements are the only reliable counter; so is scoring individually before discussing as a group.
Velocity and persistence are invisible
A matrix says nothing about how fast a risk crystallises or how long its effects last. Where that matters, add a velocity field to the register rather than overloading the likelihood score.
One matrix for everything
A safety risk and a strategic risk should not share an appetite. The template keeps one set of scales but lets the risk criteria set different acceptance and escalation thresholds per category.
The Australian context
AS ISO 31000:2018
Australia adopted ISO 31000:2018 as an identical standard. There is no separate “Australian standard risk matrix”; the former AS/NZS 4360 and its handbooks were withdrawn when the international standard was adopted, and the illustrative matrices circulating from that era are examples, not requirements.
APRA-regulated entities
CPS 220 requires a risk management framework with a risk appetite statement and a risk management strategy. A calibrated matrix and criteria are how most entities operationalise the appetite statement into scoring and escalation rules.
Commonwealth entities
The Commonwealth Risk Management Policy requires entities to define risk appetite and tolerance and to assess risks in a consistent way. The nine-category criteria template follows the structure most entities use.
Work health and safety
WHS legislation requires hazards to be identified and risks eliminated or minimised so far as is reasonably practicable. Safe Work Australia’s guidance describes assessing likelihood and consequence; a matrix is a common way to record that assessment but it is not what the duty is about. Statutory notification duties are determined by the incident facts, never by a matrix score.
Information security
ISO 27001 and ISO 27005 use the same likelihood and consequence logic for information security risk. Organisations running both an ISMS and an enterprise framework should use one calibrated set of scales so the two registers can be compared.
The information security version of the same logic, with worked rows, is the ISO 27001 risk register example. If the organisation needs its framework reviewed rather than a page read, that is Aegentra’s ISO 31000 risk management review.
Free templates
Free templates: matrix, criteria and register
The three documents on this page are published in full, free, with no email required. They are worked examples for a fictional Australian organisation, not blank forms.
- Calibrated 5×5 risk matrix (PDF)CSV
the likelihood and consequence scales on this page.
- Risk criteria and appetite statement (PDF)CSV
nine categories with acceptance, executive and board escalation thresholds and a key risk indicator each.
- Enterprise risk register (PDF)CSV
twelve worked risks scored inherently and residually on this matrix, with control effectiveness and an appetite test.
The wider set of free documents is in the Academy resource library.
Frequently asked questions
What is a risk matrix?
A risk matrix is a grid that combines the likelihood of an event with the severity of its consequence to produce a rating. The most common form is 5×5, giving scores from 1 to 25 that are grouped into bands such as Low, Moderate, High and Extreme. It is used in the risk analysis step of a risk assessment to rank risks and decide which ones need treatment or escalation.
Does ISO 31000 require a risk matrix?
No. ISO 31000:2018 sets out principles, a framework and a process for managing risk, and leaves the choice of analysis technique to the organisation. The consequence/likelihood matrix is one of the techniques described in IEC 31010, the companion standard on risk assessment techniques, which also describes its limitations. Most organisations use a matrix because it is simple to apply and to explain to a board.
What is the difference between a 3×3 and a 5×5 risk matrix?
A 3×3 matrix has three likelihood and three consequence levels, so it separates risks into fewer groups and is quicker to apply; it suits small organisations or a first pass. A 5×5 matrix gives more discrimination between risks, which matters once a register holds more than a few dozen entries or when escalation thresholds need to sit at different levels for different categories. Larger grids rarely add value because assessors cannot distinguish seven levels of likelihood reliably.
How do you define the likelihood levels in a risk matrix?
As frequency bands over a stated time horizon, supported by evidence. In the template, Almost certain means more than once a year, Likely about once a year, Possible about once in three years, Unlikely about once in ten years and Rare less than once in 25 years. The evidence column asks whether the event has occurred in the organisation or the sector within the last three years.
What do the numbers in a risk matrix mean?
The score is likelihood multiplied by consequence, so a likelihood of 3 and a consequence of 4 gives 12. The number is an ordinal rank, not a measurement: it tells you a 12 should be dealt with before a 6, not that it is twice as risky. Each organisation maps score ranges to rating bands and to the actions each band requires.
What is the difference between inherent and residual risk?
Inherent risk is the rating if the controls did not exist or failed; residual risk is the rating given the controls that are in place and shown to operate. Scoring both, with an effectiveness rating for the controls between them, shows what the controls are worth and whether the residual position sits within the organisation’s appetite.
Is there an Australian standard risk matrix?
Not as a prescribed matrix. AS ISO 31000:2018 is the identical Australian adoption of ISO 31000 and does not define scales or bands. The 5×5 examples that circulate in Australia descend from the handbooks that accompanied the withdrawn AS/NZS 4360 and from regulator guidance; they are illustrations. Each organisation is expected to define its own criteria under Clause 6.3.4.
What is the difference between a risk matrix and a risk register?
The matrix is the scoring tool; the register is the record. The register lists each risk with its description, category, inherent and residual scores, controls and their effectiveness, appetite test, treatment, owner and review date. The matrix supplies the scores and bands that appear in the register. Our free enterprise risk register shows twelve worked rows built on the matrix on this page.
How often should risk ratings be reviewed?
On a cycle set by the rating band and on change. In the template, Extreme and High risks are reviewed at least quarterly, Moderate at least six-monthly and Low annually, with any risk re-assessed when a control fails, an incident occurs, or the business or regulatory environment changes.
Is this a substitute for the standard or for advice?
No. The scales and bands on this page are a fictional, calibrated example published for study and adaptation. Implementing ISO 31000 requires the standard itself, and statutory duties, notably WHS notification duties, are determined by the facts and the legislation, not by a matrix score.
Learning to run the process rather than reading about it is the Academy’s ground: ISO 31000 Foundation covers the principles, framework and vocabulary, ISO 31000 Risk Manager covers applying the process and the techniques in this page, and ISO 31000 Lead Risk Manager covers leading the framework. The career behind the credential is set out in how to become an ISO 31000 Risk Manager in Australia.